How to Create Secure Registration Page in PHP/MySQL Part I

By secured we mean that we need to sanitize the data that is passed to our script in order to secure the registration of new account or user.

There are three different types of connectivity in MySQL. They are:

mysql = old MySQL function
mysqli = improved MySQL function
pdo = using prepared statement

Mysql_connect is currently not supported in PHP version 5.5.0. So the option left are mysqli and pdo.

In this tutorial, I will use mysql as there are still so many wanna be programmers who are using it. But we will sanitize it so it will still look secured.

Let us prepare our database table.

Database name: login
Database table: member

Using phpMyAdmin, create a database called "login".

Now select the database that you have created. Click on the SQL tab and paste the following sql code.



CREATE TABLE `login`.`member` (


  `id` INT NOT NULL AUTO_INCREMENT PRIMARY KEY, 


  `username` VARCHAR(30) NOT NULL, 


  `password` CHAR(128) NOT NULL, 


  `email` VARCHAR(50) NOT NULL, 


  `salt` CHAR(128) NOT NULL


) ENGINE = InnoDB;

Create a Registration Form called "registration.html". For the meantime let's use table for our design.



<!<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">


<html xmlns="http://www.w3.org/1999/xhtml">


<head>


<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />


<title>Register</title>


</head>


 


<body>


<form name="register" action="register.php" method="post">


 <table width="510" border="0">


  <tr>


   <td colspan="2"><p><strong>Registration Form</strong></p></td>


  </tr>


  <tr>


   <td>Username:</td>


   <td><input type="text" name="username" maxlength="20" /></td>


  </tr>


  <tr>


   <td>Password:</td>


   <td><input type="password" name="password1" /></td>


  </tr>


  <tr>


   <td>Confirm Password:</td>


   <td><input type="password" name="password2" /></td>


  </tr>


  <tr>


   <td>Email:</td>


   <td><input type="text" name="email" id="email" /></td>


  </tr>


  <tr>


   <td>&nbsp;</td>


   <td><input type="submit" value="Register" /></td>


  </tr>


 </table>


</form>


</body>


</html>

Now create registration script called "register.php".

First, let us receive the data from our registration form.



<?php


//retrieve our data from POST


$username = $_POST['username'];


$password1 = $_POST['password1'];


$password2 = $_POST['password2'];


$email = $_POST['email'];


 


if($password1 != $password2)


    header('Location: registration.html');


 


if(strlen($username) > 30)


    header('Location: registration.html');

Secure password using salt. This is called password hashing using salt. You can find more info about this at http://php.net/manual/en/faq.passwords.php



$hash = hash('sha256', $password1);


 


function createSalt()


{


    $text = md5(uniqid(rand(), true));


    return substr($text, 0, 3);


}


 


$salt = createSalt();


$password = hash('sha256', $salt . $hash);

Insert the value into "member" table.



$conn = mysql_connect('localhost', 'root', '');


mysql_select_db('login', $conn);


 


//sanitize username


$username = mysql_real_escape_string($username);


 


$query = "INSERT INTO member ( username, password, email, salt )


        VALUES ( '$username', '$password', '$email', '$salt' );";


mysql_query($query);


 


mysql_close();


 


header('Location: login.php');


?>

The important code here is the "mysql_real_escape_string". This will escape all character use for sql injection. So, only valid character will be used.

How to Create Secure Registration Page in PHP/MySQL Part I

Share this